This is not a bug cos FB connect works in this way. When user joins using FB connect, oxwall takes user's password from facebook in MD5 hash only. And next time, user must login only with FB connect. But he can change his password in any time by using "reset password" feature.